fix(login): devLoginConfig() returns null when endpoint absent, not false

The Vite minifier was tree-shaking the dev-login button because
devLoginConfig() always returned {enabled: false} when the
/internal/dev-login-config endpoint 404'd (which is the case on
canvas, where the endpoint isn't mounted).

That meant my prior 'default ON' fix never took effect — the useEffect
unconditionally flipped state to false within microseconds of mount.

Real fix: return {enabled: null} on absence. Only flip OFF when
endpoint explicitly says enabled=false. Otherwise honor the source
default.

Confidence: high
Scope-risk: narrow

src/lib/api.ts

@@ -210,17 +210,18 @@ export const api = {
     return data;
   },
 
-  async devLoginConfig(signal?: AbortSignal): Promise<{ enabled: boolean }> {
+  async devLoginConfig(signal?: AbortSignal): Promise<{ enabled: boolean | null }> {
     try {
       const init: RequestInit = { method: "GET", headers: { "Accept": "application/json" }, signal };
       const r = await instrumentedFetch("GET", `${this.config.baseUrl}/internal/dev-login-config`, init);
       if (r.ok) {
-        return await r.json() as { enabled: boolean };
+        const body = await r.json() as { enabled: boolean };
+        return { enabled: !!body.enabled };
       }
     } catch {
-      // swallow
+      // network/parse error — caller treats null as "no opinion"
     }
-    return { enabled: false };
+    return { enabled: null };
   },
 
   async workItems(signal?: AbortSignal): Promise<WorkItem[]> {

src/scenes/Login.tsx

@@ -14,12 +14,10 @@ export default function Login() {
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    // The dev-login button is intentionally on by default on canvas
-    // (the user explicitly asked for it as a documented exception until
-    // we cut over fully to SSO). The endpoint config only flips it OFF.
+    // dev-login is on by default. Only the endpoint can flip it OFF.
     api.devLoginConfig()
       .then((cfg) => { if (cfg.enabled === false) setDevLoginEnabled(false); })
-      .catch(() => { /* endpoint not present — keep default ON */ });
+      .catch(() => { /* endpoint absent → keep ON */ });
   }, []);
 
   const handleSubmit = async (e: React.FormEvent) => {